[SalesForce] Clickjack Protection

There's more on this in the Winter '13 release notes.

Interpreting the release notes, it looks like you have to go in and enable the settings. The release notes do inform the user that some pages may display as blank.

Clickjacking Protection Available

You can enable protection against clickjack attacks (also known as user interface redress attacks) for non-setup pages and your custom Visualforce pages. Setup pages already include protection against clickjack attacks. Click Your Name > Setup > Security Controls > Session Settings to select:
Enable clickjack protection for non-setup Salesforce pages Enable clickjack protection for customer Visualforce pages with standard headers Enable clickjack protection for customer Visualforce pages with headers disabled

It’s possible that pages will either display as a blank page or without the frame if either of these settings is enabled and either of the following conditions exists:

• Your organization displays Salesforce.com user interface pages within a frame or iframe.

• You use custom Visualforce pages within a frame or iframe.

The behavior varies depending on your browser and its version. To ensure that these pages will continue to work correctly in your organization, discontinue displaying these pages within a frame or iframe.

Have received further reliable information from Salesforce.

This is the expected behavior, at least for now. They will be looking into it further.

The workaround is to be sure to set ShowHeader = false on the page tag for the VisualForce page.

From my perspective, the real failure here is in communication. A failure to make it very clear in the documentation and release notes that this problem does apply to Visual Force pages on page layouts, a failure to clearly document the workaround (it's not even mentioned in the release notes), a failure to give organizations and ISVs lead time that this issue was coming so they'd have time to validate code and put in the necessary updates before user's turn on this feature an go into a panic when everything breaks. A failure of the support organization (I opened a case and got back that this was a "feature" - but without any note of the workaround).